Hector Martin

Burnout in this area is a real issue though. Some of my acquaintances - who have made massive contributions - contribute less because of it

If it's evil and assholeish to disclose irresponsibly, what would you call demotivating people and driving them to not disclose at all?

Hey, I never claimed not to be an asshole :-) but really I'm just annoyed he put his paper ahead of everything else.

I appreciate debate about disclosure timelines and even FD is fine, but just why on Earth would you say nothing for months.

Heck, the paper would be *improved* by including relevant discussion about vendor responses and fix approaches and indeed many do so.

Imo don't complain someone is taking fame and reputation as reward for their work unless you're offering some other form of currency

Yes it's selfish and self-serving. So what? So is charging for the software I make instead of making it freeware.

There is a significant moral difference between withholding access to software and withholding vuln info, esp. for something this widespread